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Everywhere Security 


Unified security everywhere across the Internet, 
employees and networks to reduce complexity and 
accelerate your business. 


— i 
Problem: Complex & disjointed IT Solution: Everywhere Security 
Infosec chaos creates opportunities for attackers Simplify your approach with one unified platform 
Most IT architectures are too complicated or outdated Regain control, lower costs and reduce risks by 
to enforce security everywhere it should be. Security converging security onto Cloudflare’s intelligent 
teams are forced to stitch together siloed tools platform of programmable, cloud-native services. 
manually with limited visibility and imprecise controls 
across environments, slowing down your business. Protect your organization everywhere... 


° throughout IT environments 
across the attack lifecycle 
e and around the world. 


All this complexity had led to overworked teams, 
widening vulnerabilities, more damaging attacks and an 
unsustainable level of resources just to keep up with 
yesterday’s threats. 


Protect Protect Protect 
The Internet Employees Networks 


v WAF/API Security v SSE Services v L3 DDoS Protection 
v DDoS Protection {v Email Security v WAN/FWaaS 


+. More +. More + More 


Risks are escalating... 


Attack surfaces are expanding Security teams are struggling Innovation outpaces security 

75% 40% 89% 

fe) fe) fe) 

of the Fortune 100 operate with of IT & security staff say they of ClSOs say digital 
hybrid work. New norms like are losing control of their transformation, which includes 
this, plus modern API-first app environments, while juggling experimenting with Al and 
development, are creating more larger workloads and more building new apps, introduces 
entry points for attackers.! challenging responsibilities.” new data risks.? 
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Cloudflare | Everywhere Security 


Lifecycle of a cyber attack 


Traditional security with point solutions and a flat network architecture makes it easier for 
cyber attacks to target your IT environment and progress through their lifecycle. 


Q) Discover Attack Surface 


Attackers begin by discovering some vulnerability 
in your expanding attack surface. 


As IT environments sprawl, these entry points 
multiply, including exposed IPs and IT assets with 
misconfigurations or vulnerabilities in a FW/VPN, 
self-hosted app/API, SaaS app or web browser. 


@) Initial Compromise 


Attackers then exploit that entry point to gain a 
foothold in your IT environment. 


Tactics include phishing credentials from users or 
exploiting apps via API abuse or credential stuffing. 


Outdated tooling typically leaves more 
vulnerabilities and security gaps for compromise. 


Q) Discover Attack Surface 


Inbound risks 

API abuse 

Email phish & BEC 
Ransomware 
DDoS & bots 
0-day exploits 


Browsing risks 
Encrypted traffic 
Drive-by malware 
Phish/risky site 


Outbound risks 
Data loss 

Data exposure 
Noncompliance 


@) Exfiltration & Extortion 


@ Exfiltration & Extortion 


Typically, attackers end their campaign by stealing 
your money or data or by leaving your business in 
disarray via sabotage. 


Other times, they communicate outbound to 
command-and-control servers to execute 
additional attacks. 
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IT Environment 


SA 


© Initial Compromise 


Corporate network 
WAN, DMZ, DCs 


Public clouds 
AWS, GCP, Azure 


Public resources 
Apps, APIs, sites 


SaaS apps 
M365, GSuite 


Remote locations 
Branch office, facility 


Internal resources 
Apps, systems, data 


Remote workers 
Home, mobile 


© Lateral Movement 


@ Lateral Movement 


Once inside, attackers often move laterally and 
escalate privileges within your environment to 
reach their desired target. 


Flat, unsegmented architectures with default-allow 
access to resources make this phase easy. 
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Cloudflare | Everywhere Security 


Everywhere Security neutralizes the attack lifecycle 


Via a single platform, Cloudflare helps neutralize cyber attacks everywhere, across every 
stage of the attack lifecycle and for any endpoint, infrastructure or resource. 


O) Minimize Attack Surface 


When you connect networks and apps to 
Cloudflare, you minimize your attack surface by 
hiding IP addresses, configurations and IT assets. 


Isolate web browsing on our network edge to 


insulate users and devices from threat or data risks. 


© Prevent Initial Compromise 


Protect the entire corporate network and 
everything you connect to the Internet with L3-L7 
services to mitigate inbound risks. 


Inspect all encrypted traffic, where most threats 
lurk — even when the latest cryptography is used. 


(T) Minimize Attack Surface 


L2-7 Cloudflare network ¢ Hide IPs, config & assets 
Isolate browsing risks 


es 


y, 


® Stop Exfiltration & Extortion 


L7 data protections • Data in transit & in use controls 
Data at rest visibility 


(©) Stop Exfiltration & Extortion 


Regain visibility and controls over your data to stop 
exfiltration or fraud and to mitigate exposure risk. 


Adapt to risks with agility by extending Zero Trust 
principles with composable capabilities across 
web, private, and SaaS apps. 


IT Environment 


SAF 


Your endpoints, infrastructure & resources 


© Prevent Initial Compromise 
L3-7 threat defenses * Decrypt & inspect traffic 


Block risky traffic & content 
e Q 


© Eliminate Lateral Movement 


L4-7 secure access Ħ Default-deny privilege 
Log & segment granted access 


(©) Eliminate Lateral Movement 


Eliminate lateral movement with Zero Trust best 
practices of default-deny and least-privilege. 


Progressively adopt identity- and context-based 
controls to secure access across environments. 
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Cloudflare | Everywhere Security 


Benefits 


By reducing complexity and delivering security everywhere, Cloudflare heps CISOs 
accelerate their strategic priorities and modernize their business with tangible results. 


OUTCOMES WITH CLOUDFLARE 


on threats 
blocked 
at scale 170B daily j 


CISO AGENDA 


reduced 


Improve o S 
ostütë 90% malicious 
p traffic* 


Reduce Cyber Risk 


© 


TEO 


Digital Transformation 


Control Operational Costs 


Innovation and Al 


Ti Regain operational 


| control 


Vendor & platform 
consolidation 


More productive 


user experiences 


The Cloudflare difference 


Me 


Unified & composable platform 


Converge web app & API 
protection (WAAP), security 
services edge (SSE), email 
security and more security 
domains on one platform and 
control plane. 


Limitless interoperability 
between all services and 
flexible integrations with 
third-party tools, so security 
can adapt quickly to new risks. 


C 


Mass scale threat intelligence 


Cloudflare’s threat intel is based 
on a high volume and variety of 
global traffic, including: 


e 20% of the Internet 

e 2TB DNS queries / day 

e 8B+ pages crawled every 
two weeks 


This unique real-time visibility 
powers Al/ML-backed models to 
defend against emerging and 
zero-day threats. 


1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com 


Reduced time spent 
managing security tools? 


Total cost of ownership 
(TCO) reduction® 


of world’s Internet users 
within 50ms of our network 


K 


A network built to scale 


Deliver local capabilities with 
global scale: 


310+ network locations 
120+ countries 

228 Tbps capacity 
13K+ interconnects 


Every security service is 
available for customers to run in 
every location, such that 
single-pass inspection and 
policy enforcement is always 
fast, consistent and resilient. 
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Customer stories 


How Cloudflare helps organizations protect their attack surface 


EVARTS 


Se) Homeland a. 
wy (GPC) 
TEEI . 


iS 
A F 
AN Ke 
LAND SEC 
* * 


+ x 
20 YEARS 


1 O O cls U.S. civilian agencies 4 5 O M threats blocked 
with office locations secured in one year across 
with Cloudflare’s DNS filtering 900+ web properties 


Learn more Learn more 


How Cloudflare helps stop zero-day threats 


HTTP/2 Rapid Reset zero day ivanti Connect Secure zero day 
In Aug. 2023, Cloudflare helped to discover Cloudflare’s Al-enabled WAF proactively defends 
CVE-2023-44487 and mitigated the largest against attacks on two recently discovered 
DDoS attacks on our record. zero-day vulnerabilities affecting Ivanti products. 


2 01 M requests per second peak. < 24 hours after CVEs published, 


3x previous record. new WAF rules are available. 
Learn more Learn more 


How Cloudflare helps organizations adopt Zero Trust 


100K+ bouvet ieas" 


hybrid workers protected. “We depend on Cloudflare to reduce our attack 


surface by securing our ports, filtering threats, 
Fortune 500 telecom secured and cleaning up our traffic.” 


Internet and app access with : ; 
Learn more Zero Trust and replaced Cisco. — Victor Persson, Security Operations Lead 


Learn more 
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The Cloudflare cybersecurity portfolio 


Unify your security approach with web app and API protection (WAAP), security services 


edge (SSE), email security & many more domains. Adopt new capabilities at your own pace. 


Protect The Internet 
Defend sites, apps & APIs 
across self-hosted, SaaS, 
and cloud environments 


WAF 
API Security 
Bot Management 


Protect Employees 
Secure any worker 
anywhere, with a fast, 
consistent experience 


Secure Access 
Internet Gateway 


Protect Networks 


Safer and faster 
connectivity across data 
centers, offices, and clouds 


WANaaS 
FWaaS 
L3 DDoS Protection 


Simplify security. 
Consolidate vendors to 
reduce complexity and 
enterprise risk. 


See more, protect more. 
Leverage real-time 
threat intelligence from a 
massive global network. 


L7 DDoS Protection 
Client-Side Security 
Attack Surface Mgmt 


Email Security Network Interconnect 
Browser Isolation Smart Routing 


Scale everywhere. 
DLP IDS/IPS 


Resilient protections 
across any location 
around the world. 


{v 
{v 
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v 
v 
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A®@a Cloudflare Global Network 


Modernize your 


cybersecurity approach 
wi, 


Request a workshop P r 


BuildRemote.com 
Forrester Consulting 

Salt, State of the CISO 2023 

Based on average across 4 case studies 
Based on customer survey data collected 
through TechValidate (June-August 2023) 
TechValidate survey 


aARWNs 
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